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REMARKS 

I. Examiner Interview of September 8, 2010 

Applicant acknowledges, with appreciation, the opportunity for the telephonic interview 
conducted on September 8, 2010, between the undersigned representative for Applicant, 
Examiner Sims, and Examiner Pyzocha. During the interview, Applicant's representative 
presented reasons for patentability of pending claims 26 and 38 over the references cited in the 
Office Action. Applicant acknowledges that, as reflected in the Examiner Interview Summary, 
mailed on September 10, 2010, the Examiner's agreed with Applicant's reasons, specifically 
indicating that "Dettinger does not teach all the limitations that it was relied upon for." The 
substance of Applicant's remarks and the Examiner's response during the interview are reflected 
in the remarks below. The following remarks also reflect Applicant's response to the Examiner 
Interview Summary. 

II. Amendments to the Claims 

Claims 26-50 are pending and under examination. Applicant amends independent claims 
26 and 38. The amendments are supported by Applicant's specification at, for example, page 8 
line 28 to page 9, line 12. No new matter has been introduced by the amendments. 

III. Office Action 

In the Office Action, the Examiner took the following actions: 

(1) rejected claim 26 under 35 U.S.C. § 1 12, second paragraph; 

(2) rejected claims 26-29, 38-40, and 50 under 35 U.S.C. § 103(a) as being 
unpatentable over European Publication No. EP 1330095 Al ("Lahtinen") in view 
of U.S. Patent App. Pub. No. 2004/0073810 Al ("Dettinger"); 

(3) rejected claims 29 and 41 under 35 U.S.C. § 103(a) as being unpatentable over 
Lahtinen in view of Dettinger and U.S. Patent App. Pub. No. 2003/0149888 Al 
("Yadav"); 
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(4) rejected claims 30 and 42 under 35 U.S.C. § 103(a) as being unpatentable over 
Lahtinen in view of Dettinger and U.S. Patent No. 7,301,899 ("Goldstone"); 

(5) rejected claims 31, 32, 43, and 44 under 35 U.S.C. § 103(a) as being 
unpatentable over Lahtinen in view of Dettinger, and further in view of U.S. 
Patent App. Pub. No. 2004/0015725 Al ("Cole"); 

(6) rejected claims 33, 34, 45, and 46 under 35 U.S.C. § 103(a) as being 
unpatentable over Lahtinen in view of Dettinger, Cole, and U.S. Patent 
No. 7,246,376 ("Mohrram"); and 

(7) rejected claims 35-37 and 47-49 under 35 U.S.C. § 103(a) as being 
unpatentable over Lahtinen in view of Dettinger and Mohrram. 

IV. Response to Rejections 

Applicant respectfully traverses the aforementioned rejections, and requests 
reconsideration based on the following remarks. 

A. Claim rejections under 35 U.S.C. § 112 

The Office Action, on pages 2-3, rejected claim 26 under 35 U.S.C. § 1 12, second 
paragraph, as being indefinite. In particular, the Office Action asserted that the limitation "said 
data" recited in the last element of the claim is not clear. Without conceding the propriety of the 
rejection, Applicant amends claims 26 and 38 to instead recite "captured data." Claim 26 thus 
complies with 35 U.S.C. § 112, second paragraph, and Applicant requests withdrawal of the 
rejection. 

B. Claim rejections under 35 U.S.C. $ 103(a) 

The Office Action rejected all pending claims under 35 U.S.C. § 103(a). Applicant 
respectfully traverses the rejections at least because the Office Action has not properly resolved 
the Graham factual inquiries, the proper resolution of which is the requirement for establishing a 
framework for an objective obviousness analysis. See M.P.E.P. § 2141(11), citing to Graham v. 
John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), as reiterated by the U.S. Supreme Court in 
KSR International Co. v. Tele/lex Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007). Here, the scope 
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and content of the prior art have not been properly determined, nor have the differences between 

the claimed invention and the prior art been properly ascertained. 

Specifically, as agreed by the Examiners during the Examiner Interview, Lahtinen and 

Dettinger, whether considered separately or combined, do not teach or suggest an "intrusion 

detection system" which comprises "a non-transitory computer readable medium encoded with a 

computer program product" which includes: 

instructions for a sniffer for capturing data being transmitted on said network, 
instructions for a pattern matching engine for comparing the captured data with 
the attack signatures for generating an event when a match between the captured 
data and at least one attack signature is found, and 

instructions for a response analysis engine triggered by said event, for comparing 
with response data being transmitted on said network as a response to said 
captured data and for correlating results of said comparisons with attack and 
response signatures for generating an alarm, 

as recited in pending claim 26. 

Moreover, Applicant contends that the cited references do not teach or suggest the 

additional features recited in the amended claims 26 and 38. That is, the cited references do not 

teach or suggest an "intrusion detection system" which comprises " a database storing attack 

signatures and, for each of the attack signatures, a set of at least one corresponding response 

signature ," or "a non-transitory computer readable medium encoded with a computer program 

product" which includes "instructions for a response analysis engine . . . for selecting, from the 

database, a selected set of at least one response signature corresponding to the at least one 

matched attack signature , and comparing, with the selected set of at least one response signature, 

response data being transmitted on said network as a response to said captured data," as recited 

in amended claim 26. 

Pending claim 38, although differing in scope from claim 26, recites features similar to 
the above features of claim 26. Moreover, claims 27-29, 39, 40, and 50, each depend from, and 
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incorporate features of, one of claims 26 or 38. Therefore, for at least the above reasons, claims 
26-29, 38-40, and 50 are patentable over Lahtinen and Dettinger. 

Further, claims 30-37, and 41-49 also each depend from, and incorporate features of, one 
of claims 26 and 38. In its rejections of claims 30-37 and 41-49, the Office Action relied on 
Lahtinen and Dettinger for disclosing features recited in the base claims 26 and 38, and further 
cited Yadav, Goldstone, Cole, and Mohrram for disclosing additional features recited in the 
rejected claims. Regardless of whether Yadav, Goldstone, Cole, and Mohrram disclose those 
additional features, which Applicant does not concede, Yadav, Goldstone, Cole, and Mohrram, 
whether considered separately or in any combination with Lahtinen and Dettinger, do not cure 
the above-described deficiencies of Lahtinen and Dettinger. 
V. Conclusion 

In view of the foregoing amendments and remarks, Applicant respectfully requests 
reconsideration of this application and the timely allowance of the pending claims. 

Please grant any extensions of time required to enter this response and charge any 
additional required fees to Deposit Account No. 06-0916. 



Respectfully submitted, 



FINNEGAN, HENDERSON, FARABOW, 
GARRETT & DUNNER, L.L.P. 



Dated: October 25,2010 




Reza Sadr, Ph.D: 
Reg. No. 63,292 
(617) 452-1653 
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